Legal

Privacy Policy

Last updated July 1, 2026

The Capture Rig ("we", "us", or "our") provides studio operations software for photographers. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using The Capture Rig you agree to the practices described here.

Information we collect

  • Account information. When you create an account we collect your name, email address, and billing details needed to process your subscription.
  • Studio content. Information you add to run your studio, such as brand settings, project details, intake form responses, and uploaded photos.
  • Client information. Details your clients provide through intake forms or pre-registration, such as their name and contact details. You are responsible for obtaining appropriate consent from your clients.
  • Crew member information. If you use Crew Access, the name, email address, and assigned role (assistant or guest) of the crew members you invite to your studio. You control who you invite and can revoke their access at any time.
  • Usage data. Basic technical information such as device type, browser, and how features are used, to keep the service reliable and secure.

How we use information

  • To provide, maintain, and improve the service.
  • To process payments and manage your subscription.
  • To send transactional messages such as receipts, gallery notifications, and account updates.
  • To respond to support requests.
  • To protect against fraud, abuse, and security threats.

How we share information & sub-processors

We do not sell your personal information. We share information only with the service providers ("sub-processors") that help us operate The Capture Rig, and only as needed to provide the service:

  • Database, authentication & storage - hosting of your account, app data, and uploaded photos.
  • Email delivery - transactional messages such as receipts and gallery notifications.
  • Notification & delivery providers - email, SMS, push, webhook, and automation providers used to send you convenience alerts about leads, downloads, inquiries, and gallery activity.
  • Payment processing - handling subscription and client download payments.
  • Content delivery & storage (CDN) - serving images and assets quickly and securely.

We may also disclose information if required by law.

Email, SMS, push, webhook, and other notifications are convenience alerts only and are not guaranteed to be delivered, received, or read. Your Capture Rig dashboard is the official record of your leads, downloads, inquiries, and gallery activity, and you are responsible for checking it regularly.

AI Photo Finder & biometric data

Some galleries offer an optional AI Photo Finder feature that lets visitors find photos that may include them by submitting a selfie, using AI face matching scoped to a single gallery. Selfies are used only for that search and are not permanently stored, searches never cross between galleries, and face-match data is removed when the feature is disabled or the gallery is deleted. We do not sell biometric data. For full details, see our AI Photo Finder & Biometric Privacy Notice.

Cookies

We use strictly necessary cookies to keep you signed in and to keep the service secure. We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling necessary cookies may affect core functionality.

Your rights (GDPR & UK GDPR)

If you are in the EU or UK, you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Our lawful bases for processing are: performance of a contract (to provide the service), legitimate interests (to secure and improve the service), and consent where required. To exercise any right, email us. As a photographer using The Capture Rig, you act as the data controller for your clients' and crew members' information, and we act as your processor. You may also have the right to lodge a complaint with your local supervisory authority.

International data transfers

The Capture Rig and our sub-processors may store and process information in countries other than the one where you or your clients are located, including the United States. Where we transfer personal data across borders, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms, to ensure your information remains protected.

Latin America privacy rights

If you are located in Latin America, you have rights over your personal data under your country's data protection laws, and you can exercise them by emailing us.

  • Brazil (LGPD). You have the right to confirmation that we process your data, and to access, correct, anonymize, port, or delete it, as well as to obtain information about how it is shared and to withdraw consent. We process personal data on the bases of consent, performance of a contract, and our legitimate interests, as permitted by Lei Geral de Proteção de Dados (Law No. 13.709/2018).
  • Mexico (LFPDPPP). You may exercise your ARCO rights - Access, Rectification, Cancellation (deletion), and Objection - and limit the use or disclosure of your personal data, under the Federal Law on Protection of Personal Data Held by Private Parties.
  • Other countries. If you reside elsewhere in Latin America (for example Argentina, Chile, Colombia, or Peru), we extend comparable rights of access, correction, and deletion to you under your applicable local data protection laws.

California privacy rights (CCPA/CPRA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information. You will not be discriminated against for exercising these rights.

Data retention

While your account is active, your data remains available to you, and if you pause or cancel your subscription you keep access to it. After you request permanent account deletion, we remove your account and associated data from active systems. We retain certain records for the periods required by the record-keeping, legal, tax, and accounting obligations that apply in the relevant jurisdiction, and as needed to resolve disputes or enforce our agreements; these retention periods vary by jurisdiction.

Breach notification

In the event of a confirmed personal data breach affecting your information, we will notify affected users and, where applicable, regulators without undue delay and within 72 hours of becoming aware of it.

Security

We use industry-standard safeguards to protect your information, including encryption in transit, row-level access controls, optional two-factor authentication, and short-lived signed URLs for private photos. No method of transmission or storage is completely secure, but we work to protect your data and continuously improve our protections.

Your choices

You can access and update most of your information from within the app. You may also request a copy of your data or its deletion by emailing us.

Contact

Questions about this policy? Email us at support@thecapturerig.com.